JSONPath-Plus · brettz9 · May 5, 2024 · Dec 23, 2022 · Dec 28, 2022 · Dec 28, 2022
diff --git a/.eslintignore b/.eslintignore
@@ -1,6 +1,7 @@
-node_modules
-dist
+node_modules/
+dist/
 docs/ts
 coverage
 ignore
 !*.js
+!.config.js
diff --git a/.eslintrc.cjs b/.eslintrc.cjs
@@ -17,6 +17,7 @@ module.exports = {
             'XMLHttpRequest'
         ]
     },
+    parser: '@babel/eslint-parser',
     overrides: [
         {
             files: ['src/jsonpath-node.js', 'test-helpers/node-env.js'],

diff --git a/README.md b/README.md
@@ -187,6 +187,13 @@ evaluate method (as the first argument) include:
   operating on untrusted user input, for example), one may wish to
   set this option to `true` to throw exceptions when these expressions
   are attempted.
+- ***evalType*** (**default: "safe"**) - Script evaluation method.
+  `safe`: In browser, it will use a minimal scripting engine which doesn't
+  use `eval` or `Function` and satisfies Content Security Policy. In NodeJS,
+  it has no effect and is equivalent to native as scripting is safe there.
+  `native`: uses the native scripting capabilities. i.e. unsafe `eval` or
+  `Function` in browser and `vm.Script` in nodejs. `none`: Disabled scripting.
+  This is equivalent to  `preventEval: true`
 - ***parent*** (**default: null**) - In the event that a query could be
   made to return the root node, this allows the parent of that root node
   to be returned within results.

diff --git a/.babelrc.json → babel.config.json b/.babelrc.json → babel.config.json
diff --git a/badges/coverage-badge.svg b/badges/coverage-badge.svg
diff --git a/badges/tests-badge.svg b/badges/tests-badge.svg
diff --git a/demo/index.html b/demo/index.html
@@ -9,15 +9,59 @@
   <body>
     <h2>JSONPath Demo <i id="demoNode">(To demo on Node instead, see the <a href="https://npm.runkit.com/jsonpath-plus">library on Runkit</a>.)</i>
 </h2>
-    <form>
+    <form onsubmit="return false">
       <div>
         <label><b>JSONPath:</b>
-          <input id="jsonpath" placeholder="$.books" />
+          <input type="text" id="jsonpath" placeholder="$.books" value="$..book[?(@parent.bicycle && @parent.bicycle.color === &quot;red&quot;)].category" />
+        </label>
+        <label><b>evalType:</b>
+          <select id="evalType">
+            <option value="safe">safe</option>
+            <option value="native">native</option>
+            <option value="none">none</option>
+          </select>
         </label>
       </div>
       <div id="jsonSampleContainer" class="container">
         <label><b>JSON sample:</b>
-          <textarea id="jsonSample" placeholder="{&quot;books&quot;: []}"></textarea>
+          <textarea id="jsonSample" placeholder="{&quot;books&quot;: []}">
+{
+  "store": {
+    "book": [
+      {
+        "category": "reference",
+        "author": "Nigel Rees",
+        "title": "Sayings of the Century",
+        "price": 8.95
+      },
+      {
+        "category": "fiction",
+        "author": "Evelyn Waugh",
+        "title": "Sword of Honour",
+        "price": 12.99
+      },
+      {
+        "category": "fiction",
+        "author": "Herman Melville",
+        "title": "Moby Dick",
+        "isbn": "0-553-21311-3",
+        "price": 8.99
+      },
+      {
+        "category": "fiction",
+        "author": "J. R. R. Tolkien",
+        "title": "The Lord of the Rings",
+        "isbn": "0-395-19395-8",
+        "price": 22.99
+      }
+    ],
+    "bicycle": {
+      "color": "red",
+      "price": 19.95
+    }
+  }
+}
+</textarea>
         </label>
       </div>
       <div id="resultContainer" class="container">

diff --git a/demo/index.js b/demo/index.js
@@ -33,7 +33,8 @@ const updateResults = () => {
     }
     const result = JSONPath.JSONPath({
         path: $('#jsonpath').value,
-        json
+        json,
+        evalType: $('#evalType').value
     });
 
     $('#results').value = JSON.stringify(result, null, 2);
@@ -46,3 +47,7 @@ $('#jsonpath').addEventListener('input', () => {
 $('#jsonSample').addEventListener('input', () => {
     updateResults();
 });
+
+$('#evalType').addEventListener('change', () => {
+    updateResults();
+});